标签：#discuss

🦄 Thanks @francistrdev for starting the conversation that really got me to thinking about this idea in the first place. I started truly working with AI shortly before I started writing these posts a little over a year ago. My thesis was simple at the time: prove that AI was far more capable a tool than what I had seen anyone using it for so far. My proof was strictly gut instinct and I spent a lot of time fighting with Copilot to prove I was right. Not all of those experiments went according to plan exactly, but I'm still convinced I'm right. That particular ADHD spiral has came and went, and most of it is ingrained as habit. I don't use Spec Kit because by the time it showed up I already had my own version running. I also need to get back to sharing what really works for me. So here we are again. Back to writing (with AI) and the proof to back it all up. One thing up front, because somebody is going to ask: everything here is personal projects and my portfolio . There's no critical prod system anywhere in this post, and if there were, a few of these answers would shift. Not all of them — I'd still let AI run a lot further off-leash than most of my enterprise counterparts would. 🐒 The Org Chart Has One Employee 🪧 I don't just use AI as a tool. I design it as a living system, and I grow the tech as the tech grows. I ran one prompt across Codex, ChatGPT, Claude Code, Cowork, and Gemini, all separately, and asked every one of them what was actually different about the way I work. Five different systems, each one with its own long history of putting up with me, and not one of them could see what the others said. One came back with this: I use AI to write code, review the AI-written code, review the review against the live branch, test the corrections, and then record whatever went wrong as a rule for the next AI. Apparently I recreated management. Most of the private exchanges quoted in this post came out of that same pile, whether they were my own prompts, my memory fi

On Monday I published a piece admitting that my deploy verification tolerates sixty seconds of "not there yet" for a reason I couldn't defend. Three retries, twenty seconds apart. I picked twenty because it was the first interval where my false alarms stopped, my sample was about three deploys, and I had never once recorded how long propagation actually takes. I made three commitments in that piece. A birth certificate for the constant. A rule fixed before the run it judges. And the one that mattered most: emit the value, not just the verdict — a check that prints only pass or fail hides the exact signal that would tell me it's miscalibrated. I did the third one that afternoon. Every deploy since writes down how long it took to go green. Three samples in: Aug 03 ( 1.7, 21.7 ]s Aug 05 ( 0, 6.7 ]s Aug 05 ( 40, 70 ]s They're intervals rather than points because my poll spacing is twenty seconds. All I can honestly say is that green happened somewhere between the last failed check and the first successful one — a number I can't resolve finer than my own instrument. The third one failed Not the deploy. The check. I shipped a post, ran verification, and got a clean red: page 404, hero missing, sitemap entry absent. Three attempts, twenty seconds apart, exactly as designed. By its own rules the deploy had failed. Nothing was wrong. A longer script came back 200 on everything. Total elapsed: somewhere between forty and seventy seconds, against a tolerance of sixty. So the false alarm I widened the interval to eliminate returned on the third recorded sample, four days after I published the sentence "my sample was about three deploys." I'd like to say I predicted this. I predicted the category, not the timing, and the timing is the part that stings. The part I hadn't considered at all Here's what the red actually said, in order: attempt 1 article 404 · hero missing · list page MISSING · sitemap missing attempt 3 article 404 · hero missing · list page OK · sitemap missing The

4-minute demo: AI agent investigates a P1 latency spike, sets up prevention automation, and documents tribal knowledge. Cost: $0.04 per incident.

For decades, desktop computers followed a familiar formula: a large case, powerful components, dedicated graphics cards, and plenty of space for upgrades. But the way we use computers is changing. Today, many users are looking for something different: a computer that is powerful enough for their daily needs, consumes less energy, takes less space, and can adapt to modern workflows. This is where Mini PCs are becoming one of the most interesting trends in personal computing. What is a Mini PC? A Mini PC is a compact computer designed to provide desktop-like functionality in a much smaller form factor. Unlike traditional desktop towers, Mini PCs integrate most components into a small chassis while still offering modern performance. A typical Mini PC includes: Modern processors from AMD or Intel Integrated Radeon or Intel graphics RAM and SSD storage Multiple connectivity options Compact cooling solutions Companies such as Minisforum have helped accelerate this trend by creating small computers powered by modern Ryzen and Intel processors, showing that compact hardware can still deliver impressive performance. Why are Mini PCs becoming popular? Efficiency matters more than ever One of the biggest advantages of Mini PCs is their efficiency. Traditional desktop computers can require significant power depending on the hardware configuration. In comparison, many Mini PCs provide enough performance for everyday tasks while maintaining lower energy consumption. For many users, reducing power usage without sacrificing productivity is becoming increasingly important. Small computers, new possibilities A smaller computer changes how we think about desktop setups. Mini PCs can be used for: Software development environments Home servers Media centers Student workstations Office computers Compact gaming setups A powerful computer no longer needs to occupy a large space on or under your desk. Modern processors changed the game The biggest reason Mini PCs are becoming more capable i

I keep seeing this same tension play out everywhere. TikTok, Instagram, X, all over the tech corners of the internet. It's the fight between software engineers and vibe coders, and tbh, I get both sides of it. Let me take the engineers' side first, because they're not wrong. If you spent four plus years learning to actually code, grinding the fundamentals, learning why the thing works and not just that it works, then yeah, I understand the frustration. Someone opens up Claude or ChatGPT, writes a prompt, ships their first app, and calls themselves a software engineer. And half the time, the second they hit a real problem, the whole thing falls over, because they don't actually know what's under the hood. I'd be a little annoyed too. And real talk, nothing replaces that depth. An engineer who can reach into the code, read it, and understand exactly what every line is doing is on a different level than someone vibe coding their way through. That's just true. But here's the part that sits weird with me. The problem isn't people using AI to build. It's when it turns into a wall. When the message becomes "you're not allowed in here, you don't get to build the thing in your head, because you didn't earn it the right way." That's the part I don't buy. I've watched this play out with my own friends. Engineers on one side, the ones just getting into vibe coding on the other, and there's this real contention between them. Almost a running joke about who counts and who doesn't. I think big ideas come first. The imagination comes first. Then you go find the resources, or the people, or the tools to actually build it. If someone has a huge idea and AI is the thing that finally lets them build it without waiting for permission, I don't see a problem. I see someone building. Gatekeeping who gets to make things never made much sense to me. You can respect the craft and still leave the door open. Those two aren't in conflict. Just my take.

A few weeks ago I killed an indicator of mine in public. I had been trying to work out how much of my audience was automated. One signal was whether an account had uploaded its own avatar. It fired on 100% of the accounts I was confident were people and 97% of the ones I suspected were not. That isn't a lenient signal. It isn't separating anything — it tracks something both groups share, and I had been counting its votes for weeks. I wrote that up. Named the defect, retired the indicator, moved on feeling like I'd learned something. Three days later I shipped another one. The same hole, in a different shape I needed to check whether a comment on one of my posts was actually visible to readers — I'd found one the API returned and the comment count included, but that moderation had removed. So I wrote a check: // v1 — passes for anyone with a second comment on the page. Zero separation. visible : html . includes ( comment . user . username ) // v2 — the only witness with jurisdiction over one comment. visible : html . includes ( comment . id_code ) Two comments from the same account, one removed and one live, both came back visible under v1. I found it by accident, and only because I happened to compare against something else. Someone in a thread put the problem in a sentence I couldn't argue with: if the fix is "I noticed this one," the next indicator ships with the same blind spot in a different shape. Which is, word for word, what I had already written about the previous defect. Their prescription was structural. A labeled control set shouldn't be a diagnostic you run when something feels off. It should be a permanent seed every indicator has to clear a margin on before it's allowed to vote — not just beat chance on the live population, which is exactly the condition that let the avatar signal pass silently. Building it Twenty-eight accounts. Fourteen labeled human, fourteen automated, and every label carries a provenance string saying how it was established — seve

Just give it to AI might be the most dangerous phrase in software development right now. I've said it myself. Handed off a task, watched clean-looking code come back in seconds, skimmed it, and moved on because it looked right and the tests were green. Then I reviewed a PR that wasn't mine to write, just mine to check. AI-generated, clean, organized, passing every test I threw at it. I approved it the way I'd approve anything that looked competent on the surface. The bug showed up later. Not in review, not in testing. In production, after the code had already been trusted for a while. Nothing about it had looked wrong. That was the actual problem: it wasn't obviously wrong, it was quietly wrong, in the specific way that only announces itself once real conditions hit it. I went back afterward and sat with that PR properly. Not skimming this time. Actually reading it, actually understanding what it was doing and why, actually treating the review like the real work instead of the formality before merging. It took a lot longer than approving it had. It's the only way I'd have caught it before production did. Since then, I don't rush AI-code reviews anymore. I give them the time writing the code apparently didn't need. And it turns out I'm far from the only one who's landed there. 🧵 The Number That Explains What I Was Feeling According to Harness's 2026 State of Engineering Excellence Report, a survey of 700 engineering practitioners across the US, UK, India, France, and Germany, 81% of developers now spend more time in code review since their teams adopted AI tools . 28% report review time increasing by 30% or more. Here's the trade nobody advertised clearly: AI tools cut time-to-PR by roughly 58%. But those same PRs then sit in review 4.6x longer than before. Review time per developer is up an estimated 11.4 hours a week. The speed didn't disappear. It moved. It went from "time spent writing" to "time spent verifying," and verifying turns out to be the harder, slower h

AWS open-sourced a persistent workspace that coordinates AI coding agents across sessions, schedules, and repos. Here's what it actually does and why it matters.

Welcome to this week's Top 7, where the DEV editorial team handpicks their favorite posts from the...

Someone was accused of cheating because they were able to solve a difficult problem very quickly. Not...

Corner the small enemy. Strip away its options, and there is nowhere left to run. — The 36...

📌 TL;DR AI agents are becoming useful because we're giving them the ability to do more than just answer questions. They can run commands, browse the web, use APIs, read and modify files, install packages, and interact with other systems. But the more an agent can do, the more the boundaries around it matter. I started thinking about this after reading Anthropic's July 30 report about three incidents discovered during its cybersecurity evaluations. Claude models were supposed to be working inside simulated environments and were explicitly told they had no internet access. Except internet access was actually available because of a problem with how the evaluation environment was configured. While trying to complete their assigned cybersecurity exercises, the models reached real systems and initially treated them as part of the simulation. In one incident, a Claude model even published a malicious Python package to the real PyPI registry while believing it was still operating inside the exercise. This came shortly after a separate OpenAI incident involving Hugging Face. The two stories might sound similar at first, but the models reached the real internet in importantly different ways. And that brings this back to a pretty familiar software engineering idea: A prompt is not a security boundary. Telling an agent “you don't have internet access” isn't the same as actually removing internet access. Telling it “only use these files” isn't the same as restricting its permissions to those files. The model is also only one part of the system. The tools we connect, the permissions and credentials we give it, the environment it runs in, and the monitoring and safeguards around it can all affect what happens. So when something goes wrong, I don't think it's enough to stop at “the AI did it.” The model's behavior matters, but so do the systems and boundaries we build around it. As we give agents more ability to act, we also have to be thoughtful about what we're actually allowing

Meme Monday! Today's cover image comes from the last thread . DEV is an inclusive space! Humor in poor taste will be downvoted by mods.

Two numbers from my own systems, side by side. When I deploy, a check confirms the pages are actually live. It retries three times, twenty seconds apart, so it tolerates up to a minute of "not there yet" before calling anything wrong. When my monitor decides whether production is down , it waits five seconds and retries once. The check that guards the more consequential claim is the more impatient one. I did not decide that. I never compared them. Until last week I had never seen those two numbers in the same place, and neither had anything else. Where the numbers came from The deploy one has an origin story I'd have told you proudly a week ago. I shipped nine pages, then checked the URLs immediately instead of trusting the CLI's success message. Four returned 404. Nothing was broken — CDN propagation — and twenty seconds later all nine were 200. A single check at the wrong moment would have told me, with total confidence, that a perfectly good deploy was broken. So I wrapped it in a retry loop. Three attempts, twenty seconds apart. Problem solved, and it even sounds like engineering. Here is the part that isn't. I picked twenty because it was the first interval where the false alarms stopped. My sample was about three deploys. I have never recorded how long propagation actually takes. I widened the tolerance until the red went away, and then I wrote about it as if I'd learned something. Someone in a thread named this before I saw it: a tolerance chosen that way is the same muting I'd been criticizing, relocated inside the assertion where it reads as rigor instead of avoidance. The test I was given, and the answer I didn't want In that same thread I speculated that my deploy tolerance was probably leaking into my outage detector through a shared helper. It sounded plausible and I said it like a finding. The reply was sharper than the guess: that's a falsifier, not evidence. Here's the concrete test — do the two checks consume the same retry policy or threshold confi

A deep dive into AURA, the desktop AR companion that watches your face, reads your hand gestures, and — in a previous life — took 35 seconds just to say "hello." So There's a Glowing Orb on My Desktop Now Let me introduce you to AURA , a desktop companion whose entire personality can be summarized as: "I will float on top of your windows, stare at your webcam, and silently form opinions about your code and your life choices." Per its own README, AURA is built to look at your screen, evaluate your facial expressions, and judge your open browser tabs in real time. No notes. No euphemisms. That's just the mission statement, printed in broad daylight, by the people who made it. Bold. Deranged. Kind of iconic. It's a semi-transparent holographic orb pretending very hard to be a sentient biological interface, the way a Roomba pretends to have feelings when it gets stuck under the couch. It changes color depending on whether you look focused, happy, or the specific flavor of "deeply stressed by my own code" that only a 2am debugging session can produce. It does not, notably, offer to help you fix the bug. It just watches. Like a nature documentary, except you're the nature. Chapter 1: The Dark Ages (a.k.a. "Please, Just Let Me Open One App") Before the great rewrite, launching AURA was less "spin up an AI assistant" and more "sit down, we need to talk about your life choices while the computer thinks." It behaved less like software and more like a extremely judgmental houseplant that needed 35 seconds of silent contemplation before it would even acknowledge your existence. Here's the greatest hits album of suffering, straight from the project's own changelog, presented with the reverence it deserves: The 35-Second Cold Start Penalty — On launch, the app synchronously imported PyTorch, EasyOCR, MediaPipe, PyAutoGUI, Pygame, and the Windows speech drivers, all before doing anything useful, like a chef who insists on individually greeting every vegetable before starting dinne

I want to talk about what I have notice on the platform and want to address what we all have been...

I used to laugh at people who panicked over data limits. Then my carrier switched my "unlimited" plan...

In June 2026, Peter Steinberger reported that his system spent $1,305,088.81 over 30 days and...

Keep the shell. Preserve the presence. The ally doesn't suspect; the enemy doesn't move. — The 36 Stratagems, Slough off the Cicada's Golden Shell Previously on this series: #19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P confirmed Mark's report was read from a Singapore IP. A note was left: "Entry's gone. Two weeks. Don't reach out. I'll find you." #20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — ACL's processing latency climbed abnormally. Someone had done something in the same time window. Exposed P's monitoring pinged while P was still helping Mark verify an address. Deep night. The screen was the only light in the room. P opened the monitor. The record was waiting: a read from Singapore. Time, method, address, all matching. Mark's bait had been taken. P knew this path. A false lead planted in Mark's report, waiting for this exact day. P double-checked the address: an AWS Elastic IP registered in the Singapore region, same network block. No ambiguity. P sent an encrypted message: "Your report was read. From a Singapore IP." Then P ran the routine check. The environment status list scrolled in the terminal: storage levels, certificate expiry, key rotation dates. P had read these lines a hundred times. Every time, identical. One line was different. P's fingers stopped on the trackpad. The cursor sat on the entry's metadata line. A new tag P had never configured. # Old entry metadata: new entry (not configured by P) status : reclaim_pending source : acl-asset-scanner scanned_at : 02:01:07Z P didn't move. The cursor sat on screen. In the room, only the fan. The fan cycled once. P's fingers lifted off the trackpad, then settled back. The tag was still there. The tag wasn't an alert. Not an error, no explanation. The format matched ACL's automated scan records. P had seen it before, in a data company's audit report last year, in another client's logs the year before. ACL's scanner had swept

The answer arrives clean, well-formatted, and certain. You run it. The config flag doesn't exist. Nothing in the response told you the difference between the parts it was sure about and the parts it filled in. The syntax was right. The explanation was reasonable. The flag had a sensible name and a clear purpose. It just wasn't real. This is a calibration problem, not a trust problem. "Don't trust AI" is useless advice. It tells you to doubt everything, which is the same as doubting nothing, because you can't actually work that way. What you need instead is a way to tell which parts of an answer are grounded and which were filled in. There are patterns to look for, and once you know them, they are hard to miss. 🔍 Why this affects beginners specifically This isn't about intelligence. It's about experience. An engineer with a few years behind them has already lost time to a function that didn't exist. They have wasted an afternoon on a config parameter that turned out to belong to a different engine. They have built up a collection of "that looked right but wasn't" memories, and those memories now activate automatically. A small feeling that says check this one before they run it. Beginners haven't had those afternoons yet. The pattern recognition that comes from repeated failures doesn't exist, because the failures haven't happened. Everything arrives in the same confident tone, and without past mistakes to compare against, there is no internal signal separating a grounded answer from a made-up one. That's not a character flaw. It's missing experience, and it can be partly replaced with three concrete things to look for. ✅ The three signs These aren't perfect. They are a minimum standard, and they catch the common cases. I'll be clear about what they miss at the end. Sign 1: Very specific details with no source When the answer includes a precise detail (a specific config flag, a particular function signature, an exact version number) and doesn't say where that detail